Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

[tsawant]

Here's a quick question I am trying to implement calculated fields in props.conf using EVAL command following is the code that I am trying to implement:

EVAL-PAYXLINE_MV2=mvindex(PAYXLINE_MV,N,-1) 
EVAL-PAYXLINEGLOB=mvjoin(PAYXLINE_MV2," ")
EVAL-PAYXHASH=sha256(mvjoin(PAYXLINE_MV," "))

The problem is I am not able to get the first 2 commands working when I put mvindex and mvjoin directly but it works perfectly fine when I use mvjoin with sha256. Can you help me to solve this problem. Here is the documentation that I am following to define fields in props.conf.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/definecalcfields

[wpreston]

Can you share your props.conf and transforms.conf lines for the PAYXLINE_MV field?

[_d_]

Well, in your first two statements you're evaluating PAYXLINE_MV2 on the first and then calling it again on the second. Calculated fields are evaluated in parallel and not in sequence; i.e. PAYXLINE_MV2 is not availalbe to the 2nd statement when it tries to execute. Try something like this:

EVAL-PAYXLINEGLOB=mvjoin(mvindex(PAYXLINE_MV,N,-1)," ")

[n00b]

This comment about it happening in parallel vs in order fixed an issue I had for days!

[tsawant]

Not working I tried doing that previously.

[_d_]

That should work if 'PAYXLINE_MV' is indeed a multivalued field and 'N' is a number.

[tsawant]

yea its a multivalued field and N is number

[_d_]

In addition to being a number, N needs to be within the range of the length of the multivalued field.

[tsawant]

mvjoin works perfectly in props.conf right ?